3 ms·
Have you looked at idmapped mounts? I don't think it'll fix everything (only handles FS remapping, not kernel calls that are user permissioned)
by privatelypublic 1y ago
Have you looked at idmapped mounts? I don't think it'll fix everything (only handles FS remapping, not kernel calls that are user permissioned)
- diarrhea 1y agoI have not, thanks for the suggestion though. A second challenge with the particular setup I’m trying is peer authentication with Postgres, running bare metal on the host. I mount the Unix socket into the container, and on the host Postgres sees the Podman user and permits access to the corresponding DB. Works really well but only if the container user is root so maps natively. I ended up patching the container image which was the path of least resistance.